PT-2022-13901 · Unknown · Facturascripts

Neorazorx · Published 2022-04-25 · Updated 2022-05-04 · CVE-2022-1457

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions facturascripts versions prior to 2022.04

Description The issue concerns a Store XSS in the title parameter, which executes on the EditUser Page and EditProducto page. This can lead to cross-site scripting attacks, potentially resulting in devastating consequences, including data exfiltration or malware installation on the user's machine. Attackers may also masquerade as authorized users via session cookies, allowing them to perform actions permitted by the user account.

Recommendations For versions prior to 2022.04, update to a version released after 2022.04 to resolve the issue. As a temporary workaround, consider restricting access to the EditUser Page and EditProducto page to minimize the risk of exploitation. Avoid using the title parameter in these pages until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-1457

GHSA-8WP2-VXPG-XCVP

Affected Products

Facturascripts

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1457.json · Exploit
• 🔥 https://huntr.dev/bounties/8c80caa0-dc89-43f2-8f5f-db02d2669046 · Exploit
• https://github.com/neorazorx/facturascripts/commit/b3e7527d1e100898c15fec067825b6bc738613df · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-1457 · Security Note
• https://osv.dev/vulnerability/GHSA-8wp2-vxpg-xcvp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-1457 · Vendor Advisory
• https://github.com/neorazorx/facturascripts · Note